flatpak_firefox_1password.md

Hacking the flatpak isolation to get native host messaging with Firefox

Source

This is not my work, but I wanted to share it here because it's a great hack. I found it on this 1Password forum thread. The original author is Sn0wCrack.

Remarks

This is a hack, and it's not recommended to do this on a system where flatpak sandboxing is desired.

I will use the org.mozilla.firefox flatpak as an example, but this should work with any flatpak packaged firefox, I have only tried with the official package.

Instructions

1. Add org.freedesktop.Flatpak to the System Bus Talks.

   If someone is smarter than me and knows how to do this without using flatseal please let me know.

   Go to Flatseal and add org.freedesktop.Flatpak to the System Bus Talks.

   For reference check the other file in this gist.

2. Create the global 1Password configuration directory.

   sudo mkdir -p /etc/1password

3. Add flatpak-session-helper as an allowed browser.

   echo "flatpak-session-helper" | sudo tee /etc/1password/custom_allowed_browsers

4. Create a 1Password helper in Firefox's flatpak.

   We will create a wrapper script that will call the 1Password Browser Support binary with the flatpak-spawn --host command.

   mkdir -p ~/.var/app/org.mozilla.firefox/data/bin
   echo -e "#!/bin/bash\n\nflatpak-spawn --host /opt/1Password/1Password-BrowserSupport \"\$@\"" | tee ~/.var/app/org.mozilla.firefox/data/bin/1password-wrapper.sh
   chmod +x ~/.var/app/org.mozilla.firefox/data/bin/1password-wrapper.sh

5. Allow Native Host Messaging for the 1Password extension.

   mkdir -p ~/.var/app/org.mozilla.firefox/.mozilla/native-messaging-hosts
   echo '{
       "name": "com.1password.1password",
       "description": "1Password BrowserSupport",
       "path": "/home/$USER/.var/app/org.mozilla.firefox/data/bin/1password-wrapper.sh",
       "type": "stdio",
       "allowed_extensions": [
           "{0a75d802-9aed-41e7-8daa-24c067386e82}",
           "{25fc87fa-4d31-4fee-b5c1-c32a7844c063}",
           "{d634138d-c276-4fc8-924b-40a0ea21d284}"
       ]
   }' | envsubst | tee ~/.var/app/org.mozilla.firefox/.mozilla/native-messaging-hosts/com.1password.1password.json

6. Restart Firefox and 1Password.

7. Profit!

flatseal-setup.png

Thank you for this neat summary/guide ✨

If someone is smarter than me and knows how to do this without using flatseal please let me know.

This worked for me:

flatpak override --user --talk-name=org.freedesktop.Flatpak org.mozilla.firefox

Pasting the 2nd command in Step 4 simply tells me:

$ echo -e "#!/bin/bash\n\nflatpak-spawn --host /opt/1Password/1Password-BrowserSupport \"\$@\"" | tee ~/.var/app/org.mozilla.firefox/data/bin/1password-wrapper.sh
bash: !/bin/bash\n\nflatpak: event not found

Luckily it's an easy workaround since you can just manually type out the contents